Overview

overview

10

Static

static

5

fc1c010b77...5f.exe

windows7-x64

10

fc1c010b77...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2023 17:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc1c010b776b3e094b556982ff729d5f.exe

  • Size

    1.3MB

  • MD5

    fc1c010b776b3e094b556982ff729d5f

  • SHA1

    762794ee4b573f011664d872dc9de42d636fac5d

  • SHA256

    e40b3da6d63897102a14d6d17128ccdfe8d774db9b7481b89e1269e38113d786

  • SHA512

    3065a910e09ee7682853e4f97769a4302799214b514bae0bd1c79399eb97d16b457ad775e12b085105326555c64b0af01707dcf16be9fd11b1294b3424c8f09e

  • SSDEEP

    24576:btb20pkaCqT5TBWgNQ7a/PHbGinldnpLeMluAQ16AK:YVg5tQ7a/P7Gil1W5K

Score
10/10
imminentspywaretrojan

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe
    "C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\fc1c010b776b3e094b556982ff729d5f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2572
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:2884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\izggakdn
      Filesize

      321KB

      MD5

      e88090a663169843bfdfb896c079d39f

      SHA1

      e9a9996b2bd00395d0b66fed8787c822ac12586d

      SHA256

      1fe400eab095e4cce09a63bba9837b023ff938909f7f45122fd755a1ea34ff62

      SHA512

      8be247280610f3ea8fb2ae8a8d4cd4f3c26df973afdd54dea4b36f7b2fc17f8a6448c79c31fd27ce033b880794ddefbc610fca69e48edc81d35418057b383253

      Download Submit

    • memory/1676-10-0x00000000007E0000-0x00000000007E3000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2108-11-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2108-13-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2108-17-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2108-20-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2108-21-0x0000000074C20000-0x00000000751CB000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2108-27-0x0000000074C20000-0x00000000751CB000-memory.dmp

      Filesize

      5.7MB

      Download